Your laptop, phone, printer, and smart camera all share one thing: they are exposed to a new class of malware that does not follow a fixed script. On June 2, 2026, researchers at the University of Toronto published “AI Agents Enable Adaptive Computer Worms,” demonstrating a self-replicating worm powered by a free, open-weight large language model. Unlike WannaCry, which relied on a single SMB exploit and collapsed when that hole was patched, this worm reasons about each device it encounters and improvises a fresh attack.
How These Worms Actually Work
A free AI model running on your own hardware is all the attacker needs to map your device and generate a custom exploit.
Once the worm compromises a host, it runs the AI model locally on that machine’s own GPU, with no commercial AI service and no attacker-controlled server required. It reads newly published vulnerability advisories in real time and generates tailored exploits on the fly, including flaws disclosed after the model’s training cutoff, such as the CopyFail Linux kernel privilege escalation bug and a pre-authentication remote code execution vulnerability in Marimo Python notebooks.
The lab results are specific. Across a simulated 33-host network spanning Linux, Windows, and IoT devices, the worm identified an average of 31.3 vulnerabilities per run. It gained elevated access on roughly three-quarters of actively targeted hosts and replicated to approximately 62% of the full network over seven days, with no prior knowledge of network topology.
“We discovered that it is possible to create an AI-driven computer worm, using only small, free AI models, that can autonomously identify each machine’s unique weak points… There is no single defence against this new threat.” , Nicolas Papernot, Associate Professor, University of Toronto; Canada CIFAR AI Chair, Vector Institute
When a Phone Call Is the Attack
A zero-click worm built with AI assistance showed that a WeChat call alone could hijack your account before you answered.
In September 2026, Palo Alto security firm Calif disclosed WeWorm, a zero-click proof-of-concept worm exploiting a memory-corruption vulnerability in WeChat’s VoIP stack. Using AI tools, Calif identified the flaw and produced a working remote code execution exploit in roughly two days, then completed the full cross-platform worm in about a week.
In demonstrations, an Android device called an iPhone and hijacked the target’s WeChat account during the ringing state, before the call was answered. That compromised account then automatically called and infected contacts on another Android device. Tencent patched the vulnerability in iOS 8.0.76 and Android 8.0.77 and reported no exploitation in the wild.
Canadian official Samir Chhabra characterized the cost dimension as a “big change”: worms running on free models and stolen compute reduce the attacker’s marginal cost per additional target to near zero. That makes large-scale campaigns viable for a far wider range of adversaries. Researchers have also documented how a surveillance app can be weaponized against specific political groups, illustrating the breadth of state-level threats facing Canadians.
The Basics Still Matter Most
Papernot’s research found that the most exploitable gaps are human-driven, and the numbers from a January 2026 Communications Security Establishment cyber-security survey confirm exactly that.
That survey found 87% of respondents regularly update software and 77% use complex passwords, but only 31% consistently use unique passwords across accounts. That 69% gap is precisely where adaptive worms find their footing. The fixes are not exotic:
- Stop reusing passwords across devices and accounts.
- Enable multi-factor authentication wherever the option exists.
- Install security updates promptly on phones, routers, printers, and IoT devices; do not postpone update prompts.
- Organizations should streamline patch deployment so critical fixes are not held up in approval backlogs.
“We can no longer be sloppy with our cybersecurity hygiene… organizations have to change their processes to make sure that these software patches are deployed as quickly as possible.” — Nicolas Papernot
Both the University of Toronto worm and WeWorm remain proof-of-concept research, not observed attacks in the wild. The principle, however, is no longer theoretical. Papernot flags power grids, hospitals, schools, and grocery supply chains as internet-connected systems within reach of adaptive malware. For defenders, the core shift is clear: a single patched CVE no longer stops propagation. The worm can pivot to a misconfiguration, a reused password, or a newly disclosed flaw it read about this morning.
